

<!DOCTYPE html>
<html lang="zh-CN" data-default-color-scheme=auto>



<head>
  <meta charset="UTF-8">
  <link rel="apple-touch-icon" sizes="76x76" href="https://img.mkerosene.cn/touxiang.jpg">
  <link rel="icon" href="https://img.mkerosene.cn/touxiang.jpg">
  <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=5.0, shrink-to-fit=no">
  <meta http-equiv="x-ua-compatible" content="ie=edge">
  
    <meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">
  
  <meta name="theme-color" content="#2f4154">
  <meta name="author" content="Kerosene W">
  <meta name="keywords" content="">
  
    <meta name="description" content="Misc 流量分析  Q3.pcap   查看http协议对应流量，跳过多个404流量包发现200 ok响应包 tip:点击Protocol自动根据协议分类      追踪流–&gt;http流，得到    其中1、3表示将名为括号内字符串文件的文件名base64编码后被包含再压缩  2、4为压缩结果  通过命令行python解码   12import base64base64.b64decode">
<meta property="og:type" content="article">
<meta property="og:title" content="科来杯培训">
<meta property="og:url" content="http://example.com/2021/09/08/%E7%A7%91%E6%9D%A5%E6%9D%AF%E5%9F%B9%E8%AE%AD/index.html">
<meta property="og:site_name" content="追求源于热爱">
<meta property="og:description" content="Misc 流量分析  Q3.pcap   查看http协议对应流量，跳过多个404流量包发现200 ok响应包 tip:点击Protocol自动根据协议分类      追踪流–&gt;http流，得到    其中1、3表示将名为括号内字符串文件的文件名base64编码后被包含再压缩  2、4为压缩结果  通过命令行python解码   12import base64base64.b64decode">
<meta property="og:locale" content="zh_CN">
<meta property="og:image" content="https://img.mkerosene.cn/kelai.png">
<meta property="article:published_time" content="2021-09-08T05:05:24.000Z">
<meta property="article:modified_time" content="2021-10-15T05:19:37.354Z">
<meta property="article:author" content="Kerosene W">
<meta property="article:tag" content="writeup">
<meta name="twitter:card" content="summary_large_image">
<meta name="twitter:image" content="https://img.mkerosene.cn/kelai.png">
  
  
  <title>科来杯培训 - 追求源于热爱</title>

  <link  rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap@4/dist/css/bootstrap.min.css" />


  <link  rel="stylesheet" href="https://cdn.jsdelivr.net/npm/github-markdown-css@4/github-markdown.min.css" />
  <link  rel="stylesheet" href="/lib/hint/hint.min.css" />

  
    
    
      
      <link  rel="stylesheet" href="https://cdn.jsdelivr.net/npm/highlight.js@10/styles/github-gist.min.css" />
    
  

  
    <link  rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fancyapps/fancybox@3/dist/jquery.fancybox.min.css" />
  


<!-- 主题依赖的图标库，不要自行修改 -->

<link rel="stylesheet" href="//at.alicdn.com/t/font_1749284_ba1fz6golrf.css">



<link rel="stylesheet" href="//at.alicdn.com/t/font_1736178_kmeydafke9r.css">


<link  rel="stylesheet" href="/css/main.css" />

<!-- 自定义样式保持在最底部 -->


  <script id="fluid-configs">
    var Fluid = window.Fluid || {};
    var CONFIG = {"hostname":"example.com","root":"/","version":"1.8.13","typing":{"enable":true,"typeSpeed":70,"cursorChar":"_","loop":false},"anchorjs":{"enable":true,"element":"h1,h2,h3,h4,h5,h6","placement":"right","visible":"hover","icon":"❡"},"progressbar":{"enable":true,"height_px":3,"color":"#29d","options":{"showSpinner":false,"trickleSpeed":100}},"copy_btn":true,"image_zoom":{"enable":true,"img_url_replace":["",""]},"toc":{"enable":true,"headingSelector":"h1,h2,h3,h4,h5,h6","collapseDepth":0},"lazyload":{"enable":true,"loading_img":"https://img.mkerosene.cn/loading.gif","onlypost":false,"offset_factor":2},"web_analytics":{"enable":true,"baidu":null,"google":null,"gtag":null,"tencent":{"sid":null,"cid":null},"woyaola":null,"cnzz":null,"leancloud":{"app_id":"FI1uAFAYz0Q3MPDiORqd0JAN-gzGzoHsz","app_key":"EhKAjMe3bmq0WLTSgktGg2OC","server_url":null,"path":"window.location.pathname","ignore_local":false}},"search_path":"/local-search.xml"};
  </script>
  <script  src="/js/utils.js" ></script>
  <script  src="/js/color-schema.js" ></script>
</head>


<body>
  <header style="height: 70vh;">
    <nav id="navbar" class="navbar fixed-top  navbar-expand-lg navbar-dark scrolling-navbar">
  <div class="container">
    <a class="navbar-brand" href="/">
      <strong>mKerosene</strong>
    </a>

    <button id="navbar-toggler-btn" class="navbar-toggler" type="button" data-toggle="collapse"
            data-target="#navbarSupportedContent"
            aria-controls="navbarSupportedContent" aria-expanded="false" aria-label="Toggle navigation">
      <div class="animated-icon"><span></span><span></span><span></span></div>
    </button>

    <!-- Collapsible content -->
    <div class="collapse navbar-collapse" id="navbarSupportedContent">
      <ul class="navbar-nav ml-auto text-center">
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/">
                <i class="iconfont icon-home-fill"></i>
                首页
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/archives/">
                <i class="iconfont icon-archive-fill"></i>
                归档
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/categories/">
                <i class="iconfont icon-category-fill"></i>
                分类
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/tags/">
                <i class="iconfont icon-tags-fill"></i>
                标签
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/links/">
                <i class="iconfont icon-link-fill"></i>
                友链
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/about/">
                <i class="iconfont icon-user-fill"></i>
                关于
              </a>
            </li>
          
        
        
          <li class="nav-item" id="search-btn">
            <a class="nav-link" target="_self" href="javascript:;" data-toggle="modal" data-target="#modalSearch" aria-label="Search">
              &nbsp;<i class="iconfont icon-search"></i>&nbsp;
            </a>
          </li>
        
        
          <li class="nav-item" id="color-toggle-btn">
            <a class="nav-link" target="_self" href="javascript:;" aria-label="Color Toggle">&nbsp;<i
                class="iconfont icon-dark" id="color-toggle-icon"></i>&nbsp;</a>
          </li>
        
      </ul>
    </div>
  </div>
</nav>

    <div class="banner" id="banner" parallax=true
         style="background: url('https://img.mkerosene.cn/default.png') no-repeat center center;
           background-size: cover;">
      <div class="full-bg-img">
        <div class="mask flex-center" style="background-color: rgba(0, 0, 0, 0.3)">
          <div class="page-header text-center fade-in-up">
            <span class="h2" id="subtitle" title="科来杯培训">
              
            </span>

            
              <div class="mt-3">
  
  
    <span class="post-meta">
      <i class="iconfont icon-date-fill" aria-hidden="true"></i>
      <time datetime="2021-09-08 13:05" pubdate>
        2021年9月8日 下午
      </time>
    </span>
  
</div>

<div class="mt-1">
  
    <span class="post-meta mr-2">
      <i class="iconfont icon-chart"></i>
      5.8k 字
    </span>
  

  
    <span class="post-meta mr-2">
      <i class="iconfont icon-clock-fill"></i>
      
      
      18 分钟
    </span>
  

  
  
    
      <!-- LeanCloud 统计文章PV -->
      <span id="leancloud-page-views-container" class="post-meta" style="display: none">
        <i class="iconfont icon-eye" aria-hidden="true"></i>
        <span id="leancloud-page-views"></span> 次
      </span>
    
  
</div>

            
          </div>

          
        </div>
      </div>
    </div>
  </header>

  <main>
    
      

<div class="container-fluid nopadding-x">
  <div class="row nomargin-x">
    <div class="d-none d-lg-block col-lg-2"></div>
    <div class="col-lg-8 nopadding-x-md">
      <div class="container nopadding-x-md" id="board-ctn">
        <div class="py-5" id="board">
          <article class="post-content mx-auto">
            <!-- SEO header -->
            <h1 style="display: none">科来杯培训</h1>
            
              <p class="note note-info">
                
                  本文最后更新于：1 年前
                
              </p>
            
            <div class="markdown-body">
              <h2 id="Misc"><a href="#Misc" class="headerlink" title="Misc"></a>Misc</h2><hr>
<h3 id="流量分析"><a href="#流量分析" class="headerlink" title="流量分析"></a>流量分析</h3><hr>
<ol>
<li><h5 id="Q3-pcap"><a href="#Q3-pcap" class="headerlink" title="Q3.pcap"></a>Q3.pcap</h5></li>
</ol>
<ul>
<li>查看http协议对应流量，跳过多个404流量包发现<code>200 ok</code>响应包<ul>
<li>tip:点击Protocol自动根据协议分类</li>
</ul>
</li>
</ul>
<p><img src="https://img.mkerosene.cn/image-20210908131154447.png" srcset="https://img.mkerosene.cn/loading.gif" lazyload alt="image-20210908131154447"></p>
<ul>
<li>追踪流–&gt;http流，得到</li>
</ul>
<p><img src="https://img.mkerosene.cn/image-20210908131545509.png" srcset="https://img.mkerosene.cn/loading.gif" lazyload alt="image-20210908131545509"></p>
<ul>
<li><p>其中1、3表示将名为括号内字符串文件的文件名base64编码后被包含再压缩</p>
</li>
<li><p>2、4为压缩结果</p>
</li>
<li><p>通过命令行python解码</p>
</li>
</ul>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><code class="hljs python"><span class="hljs-keyword">import</span> base64<br>base64.b64decode(<span class="hljs-string">&#x27;str&#x27;</span>)<br></code></pre></td></tr></table></figure>

<ul>
<li>1为index.php，干扰项忽略；3为flag.txt，目标流量</li>
<li>导出分组字节流</li>
</ul>
<img src="https://img.mkerosene.cn/image-20210908132720451.png" srcset="https://img.mkerosene.cn/loading.gif" lazyload alt="image-20210908132720451" style="zoom: 80%;" />

<ul>
<li>使用php分析</li>
</ul>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-meta">&lt;?php</span><br><span class="hljs-variable">$b</span>  = file_get_contents(<span class="hljs-string">&#x27;./flag.bin&#x27;</span>);	<span class="hljs-comment">#将文件包含</span><br><span class="hljs-variable">$a</span> = gzuncompress(<span class="hljs-variable">$b</span>);					<span class="hljs-comment">#解压文件</span><br><span class="hljs-keyword">echo</span> <span class="hljs-variable">$a</span>;<br></code></pre></td></tr></table></figure>

<hr>
<ol start="2">
<li><h5 id="R1-pcap（大流量数据包）"><a href="#R1-pcap（大流量数据包）" class="headerlink" title="R1.pcap（大流量数据包）"></a>R1.pcap（大流量数据包）</h5></li>
</ol>
<ul>
<li>方法一：TCP追踪流，耐心寻找可疑流量</li>
<li>方法二：统计–&gt;conversations</li>
</ul>
<img src="https://img.mkerosene.cn/image-20210908140338715.png" srcset="https://img.mkerosene.cn/loading.gif" lazyload alt="image-20210908140338715" style="zoom:80%;" />

<ul>
<li>按字节大小排序查看TCP流，从大到小找出可疑流量并追踪包</li>
</ul>
<img src="https://img.mkerosene.cn/image-20210908215953740.png" srcset="https://img.mkerosene.cn/loading.gif" lazyload alt="image-20210908215953740" style="zoom:80%;" />

<ul>
<li>发现第二个为一压缩包(图中1)</li>
</ul>
<p><img src="https://img.mkerosene.cn/image-20210908220224478.png" srcset="https://img.mkerosene.cn/loading.gif" lazyload alt="image-20210908220224478"></p>
<ul>
<li>“.”表示不可见字符</li>
<li>3处选择原始数据，由于文件较大，2位置加载需要一定时间，不要着急，点5保存为rar文件</li>
<li>使用010editor打开，删除http报文相关内容，提取rar</li>
</ul>
<img src="https://img.mkerosene.cn/image-20210910090657988.png" srcset="https://img.mkerosene.cn/loading.gif" lazyload alt="image-20210910090657988" style="zoom:80%;" />

<ul>
<li>文件有加密，4位置表示21流，密码向前面的流寻找，加密过程在21流之前</li>
</ul>
<img src="https://img.mkerosene.cn/image-20210910091223908.png" srcset="https://img.mkerosene.cn/loading.gif" lazyload alt="image-20210910091223908" style="zoom:80%;" />

<ul>
<li>目标集中于此，进行url解码+base64解码</li>
<li>19、20流结果<code>C:\\inetpub\\wwwroot\\backup\\</code>无用</li>
<li>18流结果中，z1解码为cmd，z2为</li>
</ul>
<img src="https://img.mkerosene.cn/image-20210910092544960.png" srcset="https://img.mkerosene.cn/loading.gif" lazyload alt="image-20210910092544960" style="zoom:80%;" />

<ul>
<li><p>其中-hp<a href="#">命令</a>后接密码，打开压缩包得到<code>1.gif</code>但无法查看</p>
</li>
<li><p>查看文件类型为MDMP crash data，是内存得dump文件</p>
</li>
<li><p>载入到mimikatz，使用以下命令：</p>
</li>
</ul>
<figure class="highlight lasso"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><code class="hljs lasso"><span class="hljs-keyword">log</span> d:\<span class="hljs-number">1.</span>txt	<span class="hljs-comment">//将回显输出到文件</span><br>sekurlsa<span class="hljs-type">::minidump</span> <span class="hljs-number">1.</span>gif	<span class="hljs-comment">//载入dmp文件</span><br>sekurlsa<span class="hljs-type">::logonpasswords</span> <span class="hljs-literal">full</span>	<span class="hljs-comment">//读取登陆密码</span><br></code></pre></td></tr></table></figure>

<ul>
<li>得到flag</li>
</ul>
<hr>
<ol start="3">
<li><h5 id="Attachment-pcap-https加密"><a href="#Attachment-pcap-https加密" class="headerlink" title="Attachment.pcap(https加密)"></a>Attachment.pcap(https加密)</h5></li>
</ol>
<ul>
<li>从FTP、SMTP协议入手</li>
<li>FTP导出字节流文件无用</li>
<li>文件-&gt;导出对象-&gt;IMF</li>
</ul>
<img src="https://img.mkerosene.cn/image-20210910143327330.png" srcset="https://img.mkerosene.cn/loading.gif" lazyload alt="image-20210910143327330" style="zoom:80%;" />

<ul>
<li>按大小排序，并依次追踪流查看</li>
<li>找到如下</li>
</ul>
<img src="https://img.mkerosene.cn/image-20210910143652273.png" srcset="https://img.mkerosene.cn/loading.gif" lazyload alt="image-20210910143652273" style="zoom:80%;" />

<ul>
<li>图片base64解码</li>
</ul>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><code class="hljs python"><span class="hljs-keyword">import</span> base64<br><br>fp = <span class="hljs-built_in">open</span>(<span class="hljs-string">&#x27;2.txt&#x27;</span>,<span class="hljs-string">&#x27;r&#x27;</span>)<br>png = <span class="hljs-built_in">open</span>(<span class="hljs-string">&#x27;misc1.png&#x27;</span>,<span class="hljs-string">&#x27;wb&#x27;</span>)<br><br>bin_png = base64.b64decode(fp.read())<br>png.write(bin_png)<br><br>fp.close()<br>png.close()<br></code></pre></td></tr></table></figure>

<img src="https://img.mkerosene.cn/misc1.png" srcset="https://img.mkerosene.cn/loading.gif" lazyload alt="misc1" style="zoom:75%;" />

<ul>
<li>所得图片即为RSA私钥</li>
<li>使用ocr等其他方式提取字符内容，添加RSA key开头和结尾标识(流量分析.txt)</li>
</ul>
<img src="https://img.mkerosene.cn/image-20210910152043700.png" srcset="https://img.mkerosene.cn/loading.gif" lazyload alt="image-20210910152043700" style="zoom:50%;" />

<ul>
<li>将私钥载入wireshark流量包，编辑-&gt;首选项-&gt;Protocols-&gt;TLS-&gt;Edit-&gt;key file</li>
<li>追踪http流，得到flag</li>
</ul>
<img src="https://img.mkerosene.cn/image-20210910160440806.png" srcset="https://img.mkerosene.cn/loading.gif" lazyload alt="image-20210910160440806" style="zoom:67%;" />

<hr>
<ol start="4">
<li><h5 id="lx100-pcap"><a href="#lx100-pcap" class="headerlink" title="lx100.pcap"></a>lx100.pcap</h5></li>
</ol>
<ul>
<li>首先追踪http流</li>
</ul>
<img src="https://img.mkerosene.cn/image-20210910162446010.png" srcset="https://img.mkerosene.cn/loading.gif" lazyload alt="image-20210910162446010" style="zoom:80%;" />

<ul>
<li>发现与MP4有关，但MP4视频流为UDP协议传输，因此转向UDP流</li>
</ul>
<img src="https://img.mkerosene.cn/image-20210910162720399.png" srcset="https://img.mkerosene.cn/loading.gif" lazyload alt="image-20210910162720399" style="zoom:80%;" />

<ul>
<li>发现jpg标识，导出原始数据</li>
<li>使用脚本分离多张图片</li>
</ul>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><code class="hljs python">f = <span class="hljs-built_in">open</span>(<span class="hljs-string">&#x27;lx100&#x27;</span>, <span class="hljs-string">&#x27;rb&#x27;</span>)<br><br>data = f.read()<br>sub = <span class="hljs-number">0</span><br>f.seek(<span class="hljs-number">0</span>)<br><br><span class="hljs-keyword">while</span> <span class="hljs-number">1</span>:<br>    <span class="hljs-keyword">if</span> f.read(<span class="hljs-number">3</span>) == <span class="hljs-string">b&#x27;\xff\xd8\xff&#x27;</span>:<br>        f1 = <span class="hljs-built_in">open</span>(<span class="hljs-built_in">str</span>(sub) + <span class="hljs-string">&#x27;.jpg&#x27;</span>, <span class="hljs-string">&#x27;wb&#x27;</span>)<br>        f1.write(data[f.tell()-<span class="hljs-number">3</span>:])<br>        f1.close()<br>        sub += <span class="hljs-number">1</span><br>    <span class="hljs-keyword">else</span>:<br>        f.seek(-<span class="hljs-number">2</span>, <span class="hljs-number">1</span>)<br><span class="hljs-comment"># 图片后即使有其他无关数据也不影响正常显示，因此从头开始每个文件头依次提取其后所有数据</span><br></code></pre></td></tr></table></figure>

<ul>
<li>分离得到400+图片，寻找得到flag</li>
</ul>
<hr>
<h4 id="USB流量分析"><a href="#USB流量分析" class="headerlink" title="USB流量分析"></a>USB流量分析</h4><ul>
<li>tshark-&gt;*.py-&gt;gnuplot</li>
</ul>
<h5 id="鼠标协议"><a href="#鼠标协议" class="headerlink" title="鼠标协议"></a>鼠标协议</h5><hr>
<p>一般为四个字节：</p>
<ul>
<li>第一个代表按键：0x00没有按键，0x01左键，0x02右键</li>
<li>第二个代表左右移动像素：&lt;127右移，127~255左移</li>
<li>垂直上下移动像素</li>
<li>拓展字节，代表滚轮数据：0无滚轮运动，1垂直向上一下，0xFF垂直向下一下，2水平滚动右键一次，0xFE水平滚动左键单击一下</li>
</ul>
<p>工具：Tshark(提取数据)，gnuplot(作图工具)</p>
<ul>
<li><p><code>tshark -r xxxx.pcapng -T fields -e usb.capdata &gt;21321.txt</code></p>
</li>
<li><p>```python<br>#mouse.py</p>
<h1 id="coding-utf-8"><a href="#coding-utf-8" class="headerlink" title="-- coding: utf-8 --"></a>-<em>- coding: utf-8 -</em>-</h1><p>nums = []<br>keys = open(‘usb.txt’,’r’)<br>result = open(‘result.txt’,’w’) # 最后生成的result.txt 是一个xxx xxx 形式的坐标集合，直接用gnuplot 画图即可<br>posx = 0<br>posy = 0<br>for line in keys:</p>
<pre><code>if len(line) != 24 :
     continue
x = int(line[6:8],16) #这是代表第三个字节，如果生成的usb.txt没有: 的话，这个改为 x = int(line[4:6],16)
y = int(line[12:14],16) # 这是代表第五个字节，如需修改，与上面同理修改
if x &gt; 127 :
    x -= 256
if y &gt; 127 :
    y -= 256
posx += x
posy += y
btn_flag = int(line[0:2],16)  # 1 for left(左键) , 2 for right(右键) , 0 for nothing(无按键)
if btn_flag == 1 :
    result.write(str(posx)+&#39; &#39;+str(-posy)+&#39;\n&#39;)
</code></pre>
<p>keys.close()</p>
<figure class="highlight vim"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br></pre></td><td class="code"><pre><code class="hljs vim"><br>+ `gnuplot`<br><br>+ `plot <span class="hljs-string">&#x27;1.txt&#x27;</span>`<br><br>+ 流量包时间差<span class="hljs-number">0.001</span><br><br>##### 键盘协议<br><br>---<br><br>统一八个字节：<br><br>+ 第一个字节判断是否按下Shift、Alt、Control等键<br>+ 保留位<br>+ <span class="hljs-number">3</span>~<span class="hljs-number">8</span>字节为普通按键，击键信息集中在第<span class="hljs-number">3</span>个字节<br><br>工具同鼠标<br><br>+ ```<span class="hljs-keyword">python</span><br>  #keyboard.<span class="hljs-keyword">p</span><br>  # -*- codin<span class="hljs-variable">g:</span> utf-<span class="hljs-number">8</span> -*-<br>  # Python2<br>  mappings = &#123;<span class="hljs-number">0</span>x04:<span class="hljs-string">&quot;A&quot;</span>, <span class="hljs-number">0</span>x05:<span class="hljs-string">&quot;B&quot;</span>, <span class="hljs-number">0</span>x06:<span class="hljs-string">&quot;C&quot;</span>, <span class="hljs-number">0</span>x07:<span class="hljs-string">&quot;D&quot;</span>, <span class="hljs-number">0</span>x08:<span class="hljs-string">&quot;E&quot;</span>, <span class="hljs-number">0</span>x09:<span class="hljs-string">&quot;F&quot;</span>, <span class="hljs-number">0</span>x0<span class="hljs-variable">a:</span><span class="hljs-string">&quot;G&quot;</span>, <span class="hljs-number">0</span>x0<span class="hljs-variable">b:</span><span class="hljs-string">&quot;H&quot;</span>, <span class="hljs-number">0</span>x0c:<span class="hljs-string">&quot;I&quot;</span>, <span class="hljs-number">0</span>x0d:<span class="hljs-string">&quot;J&quot;</span>, <span class="hljs-number">0</span>x0e:<span class="hljs-string">&quot;K&quot;</span>, <span class="hljs-number">0</span>x0f:<span class="hljs-string">&quot;L&quot;</span>, <span class="hljs-number">0</span>x10:<span class="hljs-string">&quot;M&quot;</span>, <span class="hljs-number">0</span>x11:<span class="hljs-string">&quot;N&quot;</span>, <span class="hljs-number">0</span>x12:<span class="hljs-string">&quot;O&quot;</span>, <span class="hljs-number">0</span>x13:<span class="hljs-string">&quot;P&quot;</span>, <span class="hljs-number">0</span>x14:<span class="hljs-string">&quot;Q&quot;</span>, <span class="hljs-number">0</span>x15:<span class="hljs-string">&quot;R&quot;</span>, <span class="hljs-number">0</span>x16:<span class="hljs-string">&quot;S&quot;</span>, <span class="hljs-number">0</span>x17:<span class="hljs-string">&quot;T&quot;</span>, <span class="hljs-number">0</span>x18:<span class="hljs-string">&quot;U&quot;</span>, <span class="hljs-number">0</span>x19:<span class="hljs-string">&quot;V&quot;</span>, <span class="hljs-number">0</span>x1<span class="hljs-variable">a:</span><span class="hljs-string">&quot;W&quot;</span>, <span class="hljs-number">0</span>x1<span class="hljs-variable">b:</span><span class="hljs-string">&quot;X&quot;</span>, <span class="hljs-number">0</span>x1c:<span class="hljs-string">&quot;Y&quot;</span>, <span class="hljs-number">0</span>x1d:<span class="hljs-string">&quot;Z&quot;</span>,<span class="hljs-number">0</span>x1e:<span class="hljs-string">&quot;!&quot;</span>, <span class="hljs-number">0</span>x1f:<span class="hljs-string">&quot;@&quot;</span>, <span class="hljs-number">0</span>x20:<span class="hljs-string">&quot;#&quot;</span>, <span class="hljs-number">0</span>x21:<span class="hljs-string">&quot;$&quot;</span>, <span class="hljs-number">0</span>x22:<span class="hljs-string">&quot;%&quot;</span>, <span class="hljs-number">0</span>x23:<span class="hljs-string">&quot;^&quot;</span>,<span class="hljs-number">0</span>x24:<span class="hljs-string">&quot;&amp;&quot;</span>,<span class="hljs-number">0</span>x25:<span class="hljs-string">&quot;*&quot;</span>,<span class="hljs-number">0</span>x26:<span class="hljs-string">&quot;(&quot;</span>,<span class="hljs-number">0</span>x27:<span class="hljs-string">&quot;)&quot;</span>,<span class="hljs-number">0</span>x28:<span class="hljs-string">&quot;&lt;RET&gt;&quot;</span>,<span class="hljs-number">0</span>x29:<span class="hljs-string">&quot;&lt;ESC&gt;&quot;</span>,<span class="hljs-number">0</span>x2<span class="hljs-variable">a:</span><span class="hljs-string">&quot;&lt;DEL&gt;&quot;</span>, <span class="hljs-number">0</span>x2<span class="hljs-variable">b:</span><span class="hljs-string">&quot;\t&quot;</span>,<span class="hljs-number">0</span>x2c:<span class="hljs-string">&quot;&lt;SPACE&gt;&quot;</span>,<span class="hljs-number">0</span>x2d:<span class="hljs-string">&quot;_&quot;</span>,<span class="hljs-number">0</span>x2e:<span class="hljs-string">&quot;+&quot;</span>,<span class="hljs-number">0</span>x2f:<span class="hljs-string">&quot;&#123;&quot;</span>,<span class="hljs-number">0</span>x30:<span class="hljs-string">&quot;&#125;&quot;</span>,<span class="hljs-number">0</span>x31:<span class="hljs-string">&quot;|&quot;</span>,<span class="hljs-number">0</span>x32:<span class="hljs-string">&quot;&lt;NON&gt;&quot;</span>,<span class="hljs-number">0</span>x33:<span class="hljs-string">&quot;\&quot;&quot;</span>,<span class="hljs-number">0</span>x34:<span class="hljs-string">&quot;:&quot;</span>,<span class="hljs-number">0</span>x35:<span class="hljs-string">&quot;&lt;GA&gt;&quot;</span>,<span class="hljs-number">0</span>x36:<span class="hljs-string">&quot;&lt;&quot;</span>,<span class="hljs-number">0</span>x37:<span class="hljs-string">&quot;&gt;&quot;</span>,<span class="hljs-number">0</span>x38:<span class="hljs-string">&quot;?&quot;</span>,<span class="hljs-number">0</span>x39:<span class="hljs-string">&quot;&lt;CAP&gt;&quot;</span>,<span class="hljs-number">0</span>x3<span class="hljs-variable">a:</span><span class="hljs-string">&quot;&lt;F1&gt;&quot;</span>,<span class="hljs-number">0</span>x3<span class="hljs-variable">b:</span><span class="hljs-string">&quot;&lt;F2&gt;&quot;</span>, <span class="hljs-number">0</span>x3c:<span class="hljs-string">&quot;&lt;F3&gt;&quot;</span>,<span class="hljs-number">0</span>x3d:<span class="hljs-string">&quot;&lt;F4&gt;&quot;</span>,<span class="hljs-number">0</span>x3e:<span class="hljs-string">&quot;&lt;F5&gt;&quot;</span>,<span class="hljs-number">0</span>x3f:<span class="hljs-string">&quot;&lt;F6&gt;&quot;</span>,<span class="hljs-number">0</span>x40:<span class="hljs-string">&quot;&lt;F7&gt;&quot;</span>,<span class="hljs-number">0</span>x41:<span class="hljs-string">&quot;&lt;F8&gt;&quot;</span>,<span class="hljs-number">0</span>x42:<span class="hljs-string">&quot;&lt;F9&gt;&quot;</span>,<span class="hljs-number">0</span>x43:<span class="hljs-string">&quot;&lt;F10&gt;&quot;</span>,<span class="hljs-number">0</span>x44:<span class="hljs-string">&quot;&lt;F11&gt;&quot;</span>,<span class="hljs-number">0</span>x45:<span class="hljs-string">&quot;&lt;F12&gt;&quot;</span>&#125;<br>  nums = []<br>  <span class="hljs-built_in">keys</span> = <span class="hljs-keyword">open</span>(<span class="hljs-string">&#x27;usbout.txt&#x27;</span>) # 这里填写提取出来并处理好的keyusb.txt<br>  <span class="hljs-keyword">for</span> <span class="hljs-built_in">line</span> in key<span class="hljs-variable">s:</span><br>      <span class="hljs-keyword">if</span> <span class="hljs-built_in">line</span>[<span class="hljs-number">0</span>]!=<span class="hljs-string">&#x27;0&#x27;</span> <span class="hljs-built_in">or</span> <span class="hljs-built_in">line</span>[<span class="hljs-number">1</span>]!=<span class="hljs-string">&#x27;0&#x27;</span> <span class="hljs-built_in">or</span> <span class="hljs-built_in">line</span>[<span class="hljs-number">2</span>]!=<span class="hljs-string">&#x27;0&#x27;</span> <span class="hljs-built_in">or</span> <span class="hljs-built_in">line</span>[<span class="hljs-number">3</span>]!=<span class="hljs-string">&#x27;0&#x27;</span> <span class="hljs-built_in">or</span> <span class="hljs-built_in">line</span>[<span class="hljs-number">6</span>]!=<span class="hljs-string">&#x27;0&#x27;</span> <span class="hljs-built_in">or</span> <span class="hljs-built_in">line</span>[<span class="hljs-number">7</span>]!=<span class="hljs-string">&#x27;0&#x27;</span> <span class="hljs-built_in">or</span> <span class="hljs-built_in">line</span>[<span class="hljs-number">8</span>]!=<span class="hljs-string">&#x27;0&#x27;</span> <span class="hljs-built_in">or</span> <span class="hljs-built_in">line</span>[<span class="hljs-number">9</span>]!=<span class="hljs-string">&#x27;0&#x27;</span> <span class="hljs-built_in">or</span> <span class="hljs-built_in">line</span>[<span class="hljs-number">10</span>]!=<span class="hljs-string">&#x27;0&#x27;</span> <span class="hljs-built_in">or</span> <span class="hljs-built_in">line</span>[<span class="hljs-number">11</span>]!=<span class="hljs-string">&#x27;0&#x27;</span> <span class="hljs-built_in">or</span> <span class="hljs-built_in">line</span>[<span class="hljs-number">12</span>]!=<span class="hljs-string">&#x27;0&#x27;</span> <span class="hljs-built_in">or</span> <span class="hljs-built_in">line</span>[<span class="hljs-number">13</span>]!=<span class="hljs-string">&#x27;0&#x27;</span> <span class="hljs-built_in">or</span> <span class="hljs-built_in">line</span>[<span class="hljs-number">14</span>]!=<span class="hljs-string">&#x27;0&#x27;</span> <span class="hljs-built_in">or</span> <span class="hljs-built_in">line</span>[<span class="hljs-number">15</span>]!=<span class="hljs-string">&#x27;0&#x27;</span>:<br>          # 如果提取出来的数据没有: 的话，上面一行就将改为：<br>          # <span class="hljs-keyword">if</span> <span class="hljs-built_in">line</span>[<span class="hljs-number">0</span>]!=<span class="hljs-string">&#x27;0&#x27;</span> <span class="hljs-built_in">or</span> <span class="hljs-built_in">line</span>[<span class="hljs-number">1</span>]!=<span class="hljs-string">&#x27;0&#x27;</span> <span class="hljs-built_in">or</span> <span class="hljs-built_in">line</span>[<span class="hljs-number">2</span>]!=<span class="hljs-string">&#x27;0&#x27;</span> <span class="hljs-built_in">or</span> <span class="hljs-built_in">line</span>[<span class="hljs-number">3</span>]!=<span class="hljs-string">&#x27;0&#x27;</span> <span class="hljs-built_in">or</span> <span class="hljs-built_in">line</span>[<span class="hljs-number">6</span>]!=<span class="hljs-string">&#x27;0&#x27;</span> <span class="hljs-built_in">or</span> <span class="hljs-built_in">line</span>[<span class="hljs-number">7</span>]!=<span class="hljs-string">&#x27;0&#x27;</span> <span class="hljs-built_in">or</span> <span class="hljs-built_in">line</span>[<span class="hljs-number">8</span>]!=<span class="hljs-string">&#x27;0&#x27;</span> <span class="hljs-built_in">or</span> <span class="hljs-built_in">line</span>[<span class="hljs-number">9</span>]!=<span class="hljs-string">&#x27;0&#x27;</span> <span class="hljs-built_in">or</span> <span class="hljs-built_in">line</span>[<span class="hljs-number">10</span>]!=<span class="hljs-string">&#x27;0&#x27;</span> <span class="hljs-built_in">or</span> <span class="hljs-built_in">line</span>[<span class="hljs-number">11</span>]!=<span class="hljs-string">&#x27;0&#x27;</span> <span class="hljs-built_in">or</span> <span class="hljs-built_in">line</span>[<span class="hljs-number">12</span>]!=<span class="hljs-string">&#x27;0&#x27;</span> <span class="hljs-built_in">or</span> <span class="hljs-built_in">line</span>[<span class="hljs-number">13</span>]!=<span class="hljs-string">&#x27;0&#x27;</span> <span class="hljs-built_in">or</span> <span class="hljs-built_in">line</span>[<span class="hljs-number">14</span>]!=<span class="hljs-string">&#x27;0&#x27;</span> <span class="hljs-built_in">or</span> <span class="hljs-built_in">line</span>[<span class="hljs-number">15</span>]!=<span class="hljs-string">&#x27;0&#x27;</span>:<br>          <span class="hljs-keyword">continue</span><br>      nums.<span class="hljs-keyword">append</span>(<span class="hljs-keyword">int</span>(<span class="hljs-built_in">line</span>[<span class="hljs-number">4</span>:<span class="hljs-number">6</span>],<span class="hljs-number">16</span>)) # 如果提取出来的数据没有: 的话，这里就将改为 nums.<span class="hljs-keyword">append</span>(<span class="hljs-keyword">int</span>(<span class="hljs-built_in">line</span>[<span class="hljs-number">4</span>:<span class="hljs-number">6</span>],<span class="hljs-number">16</span>))<br>  <span class="hljs-built_in">keys</span>.<span class="hljs-keyword">close</span>()<br>  output = <span class="hljs-string">&quot;&quot;</span><br>  <span class="hljs-keyword">for</span> n in num<span class="hljs-variable">s:</span><br>      <span class="hljs-keyword">if</span> n == <span class="hljs-number">0</span> :<br>          <span class="hljs-keyword">continue</span><br>      <span class="hljs-keyword">if</span> n in mapping<span class="hljs-variable">s:</span><br>          output += mappings[n]<br>      <span class="hljs-keyword">else</span>:<br>          output += <span class="hljs-string">&#x27;[unknown]&#x27;</span><br>  <span class="hljs-keyword">print</span> <span class="hljs-string">&#x27;output :\n&#x27;</span> + output<br></code></pre></td></tr></table></figure></li>
<li><p>流量包时间差0.4-1.0</p>
</li>
</ul>
<h4 id="无线流量"><a href="#无线流量" class="headerlink" title="无线流量"></a>无线流量</h4><hr>
<h4 id="cacosmia-cap"><a href="#cacosmia-cap" class="headerlink" title="cacosmia.cap"></a>cacosmia.cap</h4><ul>
<li>aircrack-ng -w password.txt -b [MAC][capfile]</li>
</ul>
<p> <code>aircrack-ng -w /usr/share/wordlists/rockyou.txt -b 1A:D7:17:98:D0:51 cacosmia.cap</code></p>
<ul>
<li>KEY FOUND!</li>
<li>airdecap-ng [capfile] -e [ESSID] -p [password]</li>
<li><code>airdecap-ng cacosmia.cap -e mamawoxiangwantiequan -p 12345678 </code></li>
<li>生成cacosmia-dec.cap</li>
<li>打开追踪http流发现png+rar流量包</li>
</ul>
<img src="https://img.mkerosene.cn/image-20210916212202795.png" srcset="https://img.mkerosene.cn/loading.gif" lazyload alt="image-20210916212202795" style="zoom: 67%;" />

<img src="https://img.mkerosene.cn/image-20210916212405932.png" srcset="https://img.mkerosene.cn/loading.gif" lazyload alt="image-20210916212405932" style="zoom:80%;" />

<ul>
<li>提取原始数据，并将压缩文件提出，发现需要密码且并非伪加密</li>
</ul>
<p><img src="https://img.mkerosene.cn/image-20210916212703310.png" srcset="https://img.mkerosene.cn/loading.gif" lazyload alt="image-20210916212703310"></p>
<ul>
<li>其中session为[JWT][<a target="_blank" rel="noopener" href="https://www.cnblogs.com/jinbuqi/p/10361698.html]%EF%BC%8C%E7%BB%93%E6%9E%84%EF%BC%9A%60header.payload.signature%60">https://www.cnblogs.com/jinbuqi/p/10361698.html]，结构：`header.payload.signature`</a></li>
</ul>
<img src="https://img.mkerosene.cn/image-20210916213547620.png" srcset="https://img.mkerosene.cn/loading.gif" lazyload alt="image-20210916213547620" style="zoom:50%;" />



<ul>
<li>解密后有提示，ping的网站去找DNS，找到最近解析的网址，输入得到flag</li>
</ul>
<hr>
<h3 id="取证"><a href="#取证" class="headerlink" title="取证"></a>取证</h3><hr>
<ol>
<li><h5 id="encrypt-vmdk-rctf"><a href="#encrypt-vmdk-rctf" class="headerlink" title="encrypt.vmdk(rctf)"></a>encrypt.vmdk(rctf)</h5></li>
</ol>
<ul>
<li>首先使用winhex无法打开，<strong>7zip等压缩工具打开验证</strong>，确实为套壳</li>
<li>（010打开可以直接查看但挂载会出问题）</li>
<li>提取文件，winhex查看发现部分flag，使用VeraCrypt挂载，得到另一个密码，继续挂载</li>
<li>磁盘为隐藏类型，使用X-Ways打开，找到另一半flag</li>
</ul>
<img src="https://img.mkerosene.cn/image-20210910160630355.png" srcset="https://img.mkerosene.cn/loading.gif" lazyload alt="image-20210910160630355" style="zoom:80%;" />

<p><img src="https://img.mkerosene.cn/image-20210910161625863.png" srcset="https://img.mkerosene.cn/loading.gif" lazyload alt="image-20210910161625863"></p>

            </div>
            <hr>
            <div>
              <div class="post-metas mb-3">
                
                  <div class="post-meta mr-3">
                    <i class="iconfont icon-category"></i>
                    
                      <a class="hover-with-bg" href="/categories/Cyber-Security/">Cyber-Security</a>
                    
                  </div>
                
                
                  <div class="post-meta">
                    <i class="iconfont icon-tags"></i>
                    
                      <a class="hover-with-bg" href="/tags/writeup/">writeup</a>
                    
                  </div>
                
              </div>
              
                <p class="note note-warning">
                  
                    本博客所有文章除特别声明外，均采用 <a target="_blank" href="https://creativecommons.org/licenses/by-sa/4.0/deed.zh" rel="nofollow noopener noopener">CC BY-SA 4.0 协议</a> ，转载请注明出处！
                  
                </p>
              
              
                <div class="post-prevnext">
                  <article class="post-prev col-6">
                    
                    
                      <a href="/2021/09/10/WinRAR%E7%9A%84%E5%91%BD%E4%BB%A4%E8%A1%8C%E6%A8%A1%E5%BC%8F%E7%94%A8%E6%B3%95%E4%BB%8B%E7%BB%8D-%E8%BD%AC/">
                        <i class="iconfont icon-arrowleft"></i>
                        <span class="hidden-mobile">WinRAR的命令行模式用法介绍(转)</span>
                        <span class="visible-mobile">上一篇</span>
                      </a>
                    
                  </article>
                  <article class="post-next col-6">
                    
                    
                      <a href="/2021/08/23/sqli%E5%9F%BA%E7%A1%80/">
                        <span class="hidden-mobile">sqli基础</span>
                        <span class="visible-mobile">下一篇</span>
                        <i class="iconfont icon-arrowright"></i>
                      </a>
                    
                  </article>
                </div>
              
            </div>

            
              <!-- Comments -->
              <article class="comments" id="comments" lazyload>
                
                  
                
                
  <div id="twikoo"></div>
  <script type="text/javascript">
    Fluid.utils.loadComments('#comments', function() {
      Fluid.utils.createScript('https://cdn.jsdelivr.net/npm/twikoo@1/dist/twikoo.all.min.js', function() {
        var options = Object.assign(
          {"envId":"blog-3gentarg3e6a1b5e","region":"ap-shanghai","path":"window.location.pathname"},
          {
            el: '#twikoo',
            path: 'window.location.pathname',
            onCommentLoaded: function() {
              Fluid.plugins.initFancyBox('#twikoo .tk-content img:not(.tk-owo-emotion)');
            }
          }
        )
        twikoo.init(options)
      });
    });
  </script>
  <noscript>Please enable JavaScript to view the comments</noscript>


              </article>
            
          </article>
        </div>
      </div>
    </div>
    
      <div class="d-none d-lg-block col-lg-2 toc-container" id="toc-ctn">
        <div id="toc">
  <p class="toc-header"><i class="iconfont icon-list"></i>&nbsp;目录</p>
  <div class="toc-body" id="toc-body"></div>
</div>

      </div>
    
  </div>
</div>

<!-- Custom -->


    

    
      <a id="scroll-top-button" aria-label="TOP" href="#" role="button">
        <i class="iconfont icon-arrowup" aria-hidden="true"></i>
      </a>
    

    
      <div class="modal fade" id="modalSearch" tabindex="-1" role="dialog" aria-labelledby="ModalLabel"
     aria-hidden="true">
  <div class="modal-dialog modal-dialog-scrollable modal-lg" role="document">
    <div class="modal-content">
      <div class="modal-header text-center">
        <h4 class="modal-title w-100 font-weight-bold">搜索</h4>
        <button type="button" id="local-search-close" class="close" data-dismiss="modal" aria-label="Close">
          <span aria-hidden="true">&times;</span>
        </button>
      </div>
      <div class="modal-body mx-3">
        <div class="md-form mb-5">
          <input type="text" id="local-search-input" class="form-control validate">
          <label data-error="x" data-success="v"
                 for="local-search-input">关键词</label>
        </div>
        <div class="list-group" id="local-search-result"></div>
      </div>
    </div>
  </div>
</div>
    

    
  </main>

  <footer class="text-center mt-5 py-3">
  <div class="footer-content">
     <div class="copyright">&copy;2020 - 2021 By Kerosene.W</div> <a href="https://hexo.io" target="_blank" rel="nofollow noopener"><span>Hexo</span></a> <i class="iconfont icon-love"></i> <a href="https://github.com/fluid-dev/hexo-theme-fluid" target="_blank" rel="nofollow noopener"><span>Fluid</span></a> 
  </div>
  
  <div class="statistics">
    
    

    
      
        <!-- LeanCloud 统计PV -->
        <span id="leancloud-site-pv-container" style="display: none">
            总访问量 
            <span id="leancloud-site-pv"></span>
             次
          </span>
      
      
        <!-- LeanCloud 统计UV -->
        <span id="leancloud-site-uv-container" style="display: none">
            总访客数 
            <span id="leancloud-site-uv"></span>
             人
          </span>
      

    
  </div>


  

  
</footer>


  <!-- SCRIPTS -->
  
  <script  src="https://cdn.jsdelivr.net/npm/nprogress@0/nprogress.min.js" ></script>
  <link  rel="stylesheet" href="https://cdn.jsdelivr.net/npm/nprogress@0/nprogress.min.css" />

  <script>
    NProgress.configure({"showSpinner":false,"trickleSpeed":100})
    NProgress.start()
    window.addEventListener('load', function() {
      NProgress.done();
    })
  </script>


<script  src="https://cdn.jsdelivr.net/npm/jquery@3/dist/jquery.min.js" ></script>
<script  src="https://cdn.jsdelivr.net/npm/bootstrap@4/dist/js/bootstrap.min.js" ></script>
<script  src="/js/events.js" ></script>
<script  src="/js/plugins.js" ></script>

<!-- Plugins -->


  <script  src="/js/local-search.js" ></script>



  
    <script  src="/js/img-lazyload.js" ></script>
  



  



  
    <script  src="https://cdn.jsdelivr.net/npm/tocbot@4/dist/tocbot.min.js" ></script>
  
  
    <script  src="https://cdn.jsdelivr.net/npm/@fancyapps/fancybox@3/dist/jquery.fancybox.min.js" ></script>
  
  
    <script  src="https://cdn.jsdelivr.net/npm/anchor-js@4/anchor.min.js" ></script>
  
  
    <script defer src="https://cdn.jsdelivr.net/npm/clipboard@2/dist/clipboard.min.js" ></script>
  




  <script defer src="/js/leancloud.js" ></script>



  <script  src="https://cdn.jsdelivr.net/npm/typed.js@2/lib/typed.min.js" ></script>
  <script>
    (function (window, document) {
      var typing = Fluid.plugins.typing;
      var title = document.getElementById('subtitle').title;
      
        typing(title);
      
    })(window, document);
  </script>












  

  

  

  

  

  





<!-- 主题的启动项 保持在最底部 -->
<script  src="/js/boot.js" ></script>


</body>
</html>
